Joomla! Security News
- [20131101] Core XSS Vulnerability
- [20131102] Core XSS Vulnerability
- [20131103] Core XSS Vulnerability
[20131101] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: High
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-25
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131102] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-06
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131103] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-26
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
Microsoft Security Bulletin: Cumulative Security Update for Internet Explorer (2862772)
This Microsoft security update resolves eleven privately reported vulnerabilities in Internet Explorer.
The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: Requires restart
Affected Software: Microsoft Windows, Internet Explorer
Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability in the Unicode Scripts Processor included in Microsoft Windows.
The vulnerability could allow remote code execution if a user viewed a specially crafted document or webpage with an application that supports embedded OpenType fonts.
An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: May require restart
Affected Software: Microsoft Windows
Serious Security Warning – Windows XP
Did you know that Microsoft is stopping all support for Windows XP?
This could be a huge threat for your business, as systems running Windows XP will be out of support, so no more updates and patches will be available for your computers.
Say goodbye to security and say hello to vulnerability!
You are entitled to receive security updates until April 9 2014, after this date you will be left with an operating system that is completely obsolete from a security perspective, thus exposing your business to cyber-attacks, data theft, malware, phishing and fraudulent activities perpetrated by external attackers using your own systems.
What’s on the mind of the cybercriminal?
Did you know that cyber-criminals are purposely delaying new attacks on Windows XP? This way they can be more effective in attacking your computers once Microsoft shuts down support, so your systems will be left permanently insecure and open to exploitation. In fact you won’t even notice you have been hacked, until your network goes down, your data is leaked and you receive a call from a customer, partner or supplier inquiring as to the source of confidential information. Your competition will probably hear your name too.
Why should you care?
Unfortunately, you may be held accountable for any consequences, in addition to financial losses and a blow to your reputation as a business. Considering Microsoft operating systems (windows xp) are used by most businesses worldwide, ignoring a fundamental warning about this system becoming totally insecure in the near future cannot do much good.
Think of it as if you were doing 50,000 miles per year with your old car, running on bald tyres in mid-winter, on a road full of potholes. Would you ignore warnings from the DVLA, the car and tyre manufacturer? Your insurance would probably fail you as well. Why risk it?
Act now – you are already late!
You should consider upgrading to Windows 7 or even Windows 8 today, save time and money and most importantly, prevent your computers from being hacked into and your data leaked. If you have not yet done so, you are late, according to Microsoft: http://windows.microsoft.com/en-GB/windows/products/lifecycle
Restrict access to Java applets on your Business Network
Network administrators unable to disable Java in web browsers may be able to help mitigate this and other Java vulnerabilities by restricting access to Java applets. This may be accomplished by using proxy server rules, for example. Blocking or whitelisting web requests to .jar and .class files can help to prevent Java from being used by untrusted sources.
Filtering requests that contain a Java User-Agent header may also be effective. For example, this technique can be used in environments where Java is required on the local intranet.
The proxy can be configured to allow Java requests locally, but block them when the destination is a site on the internet.
How to Disable the Java content in a particular browser
Internet Explorer
The only way to completely disable Java in Internet Explorer (IE) is to disable Java through the Java Control Panel or uninstall Java
Firefox
- Click on the Firefox tab and then select Add-ons
- In the Add-ons Manager window, select Plugins
- Click Java (TM) Platform plugin to select it
- Click Disable (if the button displays Enable then Java is already disabled)
Chrome
- Click on the Chrome menu, and then select Settings.
- At the bottom of Settings window, click Show advanced settings
- Scroll down to the Privacy section and click on Content Settings.
- In the Content Settings panel, scroll down to the Plug-ins section.
- Under the Plug-ins section, click Disable individual plug-ins.
- In the Plugins panel, scroll to the Java section. Click Disable to disable the Java Plug-in.
- Close and restart the browser to enable the changes.
Note: Alternatively, you can access the Plug-ins settings by typing about:plugins in the browser address bar.
Safari
- Choose Safari Preferences
- Choose the Security option
- Deselect Enable Java
- Close Safari Preferences window
Web Design North Wales – Basic Web Design Principals
When designing or consulting a client on a new (or improved) website, we at I-Tech Web Design North Wales always offer a free consultation.
As a client it is always important to plan your website and your marketing strategies accordingly. Web Design is not just creating a website with a few pages and a contact us form.
Even if you are looking for a basic website you will need to think clearly about your target market, keywords (what do you want people to look for to get to your site?), content, usability, optimised design and search engine submission.
Keep it simple! Keep your web design simple..
If you are a small business offering services in your local area, there is no point in paying for the best and most sophisticated website which will cost you an arm and a leg…and perhaps more importantly cost you a huge amount of money to update, maintain, upgrade and secure.
Don’t be convinced by Design Agencies that “Basic” means not good! If what you need is a web presence at an affordable price then choose a basic website. This will give you the web presence you need for clients to find you on the web.
Make sure your business is added to Google places which will help users find your business easier.
So now you have a website that is technically optimised by using the correct coding to make it easy for search engines to find a search your site. You’ve used the correct keywords in your content, now let the search engines find your site and let Google naturally decide where you occur organically.
Now you can start thinking of search engine optimisation and you will be able to see the results.
We don’t want to down sell you high end websites, but get the right website that is right for you at the budget you can afford. Make sure the website is built in such a way that you can add more features and functionality later on as your needs change.
We would rather have clients for life than a one of project at an inflated price.
Contact I-Tech Web Design
Please contact I-Tech Web Design North Wales for a free consulation. Call us or complete our Request A Quote Web Design form to do your web design planning and create the best website for your needs.
